Executive brief
crun is a lightweight container runtime used to execute containerized applications. A vulnerability in crun's terminal setup allows attackers to redirect /dev/console to attacker-controlled paths when container configurations do not mount /dev separately, potentially compromising container isolation and allowing unauthorized file access.
Technical details
The vulnerability is a path redirection flaw in crun's terminal setup logic. When a container configuration does not provide a dedicated mount for /dev, an attacker can redirect /dev/console to an attacker-controlled path, including via the read-only-rootfs bind-mount fallback mechanism. The attack requires a non-default container configuration; containers using default configurations with fresh /dev mounts are not affected. The vulnerability affects crun versions 1.29.1 and earlier, and no patched release is currently available.
Affected products
- containers crun 1.29.1 and earlier
Timeline
- 2026-09-10: disclosed